GT-604 (Core half): one shared client, and all three surfaces deposit through it

.github/workflows/ci-cd.yml

@@ -43,6 +43,7 @@ jobs:
       # CLI before running the tests.
       - name: Build workspace dependencies + CLI
         run: |
+          npm run build --workspace @beyondnet/evolith-contracts
           npm run build --workspace @beyondnet/evolith-core-domain
           npm run build --workspace @beyondnet/evolith-agent-runtime
           npm run build --workspace @beyondnet/evolith-sdk
@@ -140,6 +141,7 @@ jobs:
 
       - name: Build workspace dependencies
         run: |
+          npm run build --workspace @beyondnet/evolith-contracts
           npm run build --workspace @beyondnet/evolith-core-domain
           npm run build --workspace @beyondnet/evolith-agent-runtime
           npm run build --workspace @beyondnet/evolith-sdk
@@ -203,6 +205,7 @@ jobs:
 
       - name: Build workspace dependencies
         run: |
+          npm run build --workspace @beyondnet/evolith-contracts
           npm run build --workspace @beyondnet/evolith-core-domain
           npm run build --workspace @beyondnet/evolith-infra-providers
 
@@ -229,6 +232,7 @@ jobs:
         run: npm ci
       - name: Build workspace dependencies
         run: |
+          npm run build --workspace @beyondnet/evolith-contracts
           npm run build --workspace @beyondnet/evolith-core-domain
           npm run build --workspace @beyondnet/evolith-agent-runtime
       - name: Run sdk-client tests with coverage
@@ -267,6 +271,7 @@ jobs:
           # core-domain + agent-runtime, which is why this job had never once
           # passed since it was wired.
           npm run build --workspace @beyondnet/evolith-contracts
+          npm run build --workspace @beyondnet/evolith-contracts
           npm run build --workspace @beyondnet/evolith-core-domain
           npm run build --workspace @beyondnet/evolith-infra-providers
           npm run build --workspace @beyondnet/evolith-core
@@ -293,7 +298,9 @@ jobs:
         run: npm ci
       # infra-providers depends on @beyondnet/evolith-core-domain (resolved from dist).
       - name: Build workspace dependencies
-        run: npm run build --workspace @beyondnet/evolith-core-domain
+        run: |
+          npm run build --workspace @beyondnet/evolith-contracts
+          npm run build --workspace @beyondnet/evolith-core-domain
       - name: Run infra-providers tests with coverage
         run: npm run test:cov --workspace @beyondnet/evolith-infra-providers
 
@@ -317,7 +324,9 @@ jobs:
       - name: Install dependencies
         run: npm ci
       - name: Build workspace dependencies
-        run: npm run build --workspace @beyondnet/evolith-core-domain
+        run: |
+          npm run build --workspace @beyondnet/evolith-contracts
+          npm run build --workspace @beyondnet/evolith-core-domain
       - name: Run agent-runtime tests
         run: npm run test --workspace @beyondnet/evolith-agent-runtime
 
@@ -336,6 +345,7 @@ jobs:
         run: npm ci
       - name: Build workspace dependencies
         run: |
+          npm run build --workspace @beyondnet/evolith-contracts
           npm run build --workspace @beyondnet/evolith-core-domain
           npm run build --workspace @beyondnet/evolith-agent-runtime
       - name: Run agent-runtime-api tests
@@ -360,7 +370,9 @@ jobs:
       # (where a dist already exists from an earlier build) and fails in CI on a
       # clean checkout — which is exactly what it did the first time this job ran.
       - name: Build workspace dependencies
-        run: npm run build --workspace @beyondnet/evolith-core-domain
+        run: |
+          npm run build --workspace @beyondnet/evolith-contracts
+          npm run build --workspace @beyondnet/evolith-core-domain
 
       - name: Run contracts tests
         run: npm run test --workspace @beyondnet/evolith-contracts
@@ -393,6 +405,7 @@ jobs:
       # do with the corpus. Building first makes the count reproducible.
       - name: Build workspace dependencies
         run: |
+          npm run build --workspace @beyondnet/evolith-contracts
           npm run build --workspace @beyondnet/evolith-core-domain
           npm run build --workspace @beyondnet/evolith-infra-providers
 

.github/workflows/evolith-validate-dogfood.yml

@@ -98,6 +98,7 @@ jobs:
       # `cli-command`, which skips the npm install.
       - name: Build workspace dependencies
         run: |
+          npm run build -w @beyondnet/evolith-contracts
           npm run build -w @beyondnet/evolith-core-domain
           npm run build -w @beyondnet/evolith-agent-runtime
           npm run build -w @beyondnet/evolith-sdk

.github/workflows/npm-release.yml

@@ -95,6 +95,7 @@ jobs:
         # against publishing an empty package.
         run: |
           rm -f src/packages/mcp-server/tsconfig.tsbuildinfo
+          npm run build --workspace @beyondnet/evolith-contracts
           npm run build --workspace @beyondnet/evolith-mcp
           test -f src/packages/mcp-server/dist/main.js
 

.github/workflows/reliability.yml

@@ -62,6 +62,7 @@ jobs:
 
       - name: Build core-api and its workspace chain
         run: |
+          npm run build --workspace @beyondnet/evolith-contracts
           npm run build --workspace @beyondnet/evolith-core-domain
           npm run build --workspace @beyondnet/evolith-infra-providers
           npm run build --workspace core-api

.github/workflows/sdk-cli-ci.yml

@@ -138,6 +138,7 @@ jobs:
 
       - name: Build workspace dependencies
         run: |
+          npm run build -w @beyondnet/evolith-contracts
           npm run build -w @beyondnet/evolith-core-domain
           npm run build -w @beyondnet/evolith-agent-runtime
           npm run build -w @beyondnet/evolith-sdk
@@ -180,6 +181,7 @@ jobs:
 
       - name: Build workspace dependencies
         run: |
+          npm run build -w @beyondnet/evolith-contracts
           npm run build -w @beyondnet/evolith-core-domain
           npm run build -w @beyondnet/evolith-agent-runtime
           npm run build -w @beyondnet/evolith-sdk
@@ -279,6 +281,7 @@ jobs:
 
       - name: Build workspace dependencies
         run: |
+          npm run build -w @beyondnet/evolith-contracts
           npm run build -w @beyondnet/evolith-core-domain
           npm run build -w @beyondnet/evolith-agent-runtime
           npm run build -w @beyondnet/evolith-sdk
@@ -345,6 +348,7 @@ jobs:
 
       - name: Build workspace dependencies
         run: |
+          npm run build -w @beyondnet/evolith-contracts
           npm run build -w @beyondnet/evolith-core-domain
           npm run build -w @beyondnet/evolith-agent-runtime
           npm run build -w @beyondnet/evolith-sdk
@@ -506,6 +510,7 @@ jobs:
 
       - name: Build workspace dependencies
         run: |
+          npm run build -w @beyondnet/evolith-contracts
           npm run build -w @beyondnet/evolith-core-domain
           npm run build -w @beyondnet/evolith-agent-runtime
           npm run build -w @beyondnet/evolith-sdk

src/packages/infra-providers/package.json

@@ -20,6 +20,7 @@
     "test:cov": "jest --coverage"
   },
   "dependencies": {
+    "@beyondnet/evolith-contracts": "^1.1.0",
     "@beyondnet/evolith-core-domain": "^1.2.0",
     "@nestjs/common": "11.1.27",
     "ajv": "8.20.0",

src/packages/infra-providers/src/index.ts

@@ -49,3 +49,23 @@ export type {
   LighthouseCategoryResult,
   LighthouseEvidenceProviderOptions,
 } from './lighthouse-evidence.provider';
+
+// GT-604 — the ONE client every verdict-producing surface deposits through. Three
+// surfaces each writing their own fetch is three chances to drop the rule engine,
+// to rename `accountableOwner` back to `owner`, or to put a `tenantId` in the body
+// — and the last is a security hole, not a typo.
+export {
+  TrackerEvaluationIngestClient,
+  EvaluationIngestError,
+  createEvaluationIngestClientFromEnv,
+  depositEvaluation,
+  EVOLITH_TRACKER_URL_ENV,
+  EVOLITH_TRACKER_API_KEY_ENV,
+} from './tracker/evaluation-ingest.client';
+export type {
+  EvaluationIngestAck,
+  TrackerEvaluationIngestClientOptions,
+  DepositOutcome,
+  DepositEvaluationInput,
+  IngestFetchLike,
+} from './tracker/evaluation-ingest.client';